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BACKGROUND 

Field 

The following relates to microelectronic circuits, and more particularly, to single-event 
effect ("SEE") resistant or hardened circuits. 
5 Related Art 

Integrated circuits used in devices that operate in intergalactic space, earth orbital 
space, and high atmospheric altitudes (e.g., commercial flight altitudes) generally have to be 
highly reliable and operate using very low levels of power. Along with these necessities, 
space, weight and cost limitations generally cause these integrated circuits be very densely 

10 populated and highly complex. 

As a consequence of operating in intergalactic space, earth orbital space, and high 
atmospheric altitudes, however, the integrated circuits are exposed to a large amount of 
radiation, which can effect their operation and, in turn, their reliability. Because the Earth's 
magnetic field deflects most outer space radiation, terrestrial-based integrated circuits are 

15 not normally exposed to large amounts of radiation. Recently, however, several radiation- 
laden atmospheric storms, which emanated from a coronal mass ejection of the sun, 
expanded into space, penetrated the Earth's magnetic field and disrupted a significant 
amount of terrestrial-based devices that use integrated circuits. 

The disruptions caused by the radiation events are believed to result from Alpha 

20 particles (hereinafter "radiation particles") interacting with the semiconductor materials (e.g., 
silicon) that make up the integrated circuits. These radiation particles are by-products of the 
natural decay of elements, and/or radiation (having kinetic energy) protons, neutrons, 
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electrons, and all the natural elements. The radiation particles are abundant in a wide range 
of energies in intergalactic space, earth orbital space, high atmospheric altitudes (e.g., 
commercial flight altitudes), and, as noted above, terrestrial space. 

When a radiation particle interferes with an integrated circuit, it can slow the circuit's 
5 performance and even upset circuit operation. For example, a radiation particle can change 
the conductance of a metal-oxide-semiconductor CMOS") transistor by changing its threshold 
voltage (V t ). In Very Large Scale Integration (VLSI) circuits, radiation particles can also 
generate significant transient voltage and current disturbances on internal supply networks 
(e.g. power and ground nodes). 

10 A radiation particle that passes into and through an integrated-circuit device transfers 

energy from the particle into the material surrounding the region into which the particle 
strikes or "hits." This energy transfer creates undesirable hole-electron pairs in the 
surrounding region. This event is known as Linear Energy Transfer (LET), which may be 
expressed in the units of MeV-cm2/mg. For given material densities, the LET can be 

15 converted into units of Coulombs/cm along a track that a particle travels once the activation 
energy for a hole-electron pair is determined. As a result, the particle can only create a finite 
amount of charge per unit distance over the length of its track. 

As its energy and mass increase, the LET of the particle also increases. The LET, 
however, does not increase unbounded, but rather reaches a maximum value regardless of 

20 how much energy the particle possesses. Once the particle achieves the maximum LET, the 

addition of more energy counter intuitively results in a reduction in the LET. 

The charge that a particle creates may be collected in the structure of the 

semiconductor device. The amount of collected charge can be calculated by multiplying the 
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LET (C/cm) by the distance that the particle travels along the particle track. For example, 
the amount of charge collected in a continuous lightly-doped-drain (LDD) region of a MOSFET 
transistor caused by a particle traveling along the LDD region may be calculated by 
multiplying the LET (C/cm) by the length of such LDD region. 
5 The charge collection along this particle track, however, may be truncated by oxide 

regions, degenerately doped P+ and N+ source-drain regions, and/or degenerately doped 
P+ and N+ well connection regions. While a particle can travel significant distances through 
the silicon material, the charge collected from the particle traveling along a particle track 
subsides at a given distance of the particle track. This distance limit may be in the range of 
10 a few microns. 

The number of hole-electron pairs separated along the track length of the radiation 
particle, however, is finite, so the nodal voltage disturbances may be temporary or have only 
a transient effect. In addition, the density of the radiation particles striking the integrated 
circuit is generally small enough that the disturbances caused by the radiation particles are 

15 treated as single events in time. Such transient disturbances are known as single-event 
transient (SET) conditions. 

After experiencing a SET condition, transistor nodes typically return to their desired 
voltage states. Consequently, the SET condition might not be a problem in and of itself. The 
consequence of having a temporary voltage disturbance on the transistor node, however, 

20 may be problematic because the SET condition may be propagated through the larger 
system. When the SET condition causes an undesirable change in the state of the larger 
system, it may be referred to as a single-event upset (SEU) condition. 
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However, for each particle strike, a finite volume exists around a critical node through 

which a particle must pass to create a SET and/or SEU condition (collectively referred to as 

Single Event Effect (SEE) conditions). This finite volume may be referred to as the sensitive 

volume. If the particle strike is outside the sensitive volume, the created charge may not be 

5 able to get to the critical node to cause a SEE condition. 

The more charge a circuit can accumulate before a SEE condition results, the greater 

the LET the circuit can tolerate. Increasing this tolerance is known as SET, SEU, and/or SEE 

condition hardening. The energized particle environment contains a variety of particle types 

and energies that result in a wide range of LETs. The density of particles versus LET 

10 decreases as the LET increases. 

Particles that strike transistors do not have a directional dependence; i.e., they can 

strike from any direction. If the LET that can cause a SEE condition and size of the sensitive 

volume is known, the probability of a SEE condition can be determined. These probabilities 

may be referred to as Soft Error Rates (SER) because they are not due to design or 

15 manufacturer defects, and because they can be corrected. 

Figs, la and lb are block diagrams illustrating a simplified layout and cross-section 

of an N-Channel MOSFET 100 experiencing a particle strike. The N-Channel MOSFET 100 

may be fabricated using a bulk material technology, such as bulk CMOS. The N-Channel 

MOSFET includes an N+ source 102, N+ drain 104, and a P+ body tie 106 all of which may 

20 be fabricated in a P-well 108; on top of which a polysilicon and oxide gate 110 may formed. 

When a particle strikes the N+ drain 104 and travels along one of finite number of 

perpendicular particle tracks, such as track A, the charge of the particle may be collected 

over a certain distance of the P-type well 108, such as the distance l A\ The amount of 
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charge collected along distance 'd' may be greater than the charge that is created by the 
initial particle strike. 

Consider, for example, the N-channel MOSFET 100 in an "OFF" state in which its 

source 102 and body tie 106 are connected to V S s, and its drain 104 is held at a high state. 

5 The high state may be a state sufficient to reverse bias the PN junction between the N+ drain 

104 and the P-Well 108. The N+ drain 104 may be held in the high state, for example, by a 

P-channel MOSFET (not shown) in an "ON" state. In this reversed-biased state, a depletion 

region 112 is created in the P-well 108 at interface of the PN junction. 

When a particle passes through the PN junction along, for example, the particle track 

10 A, then the hole-electron pairs along the particle track A may be separated by the voltage 

difference between the N+ drain 104 and a P-well 108. The resultant electron charge from 

the separation of the hole-electron pairs may collect along the particle track 'A' in the P-well 

108 from about the interface of the N+ drain 104 to the maximum collection distance limit. 

Consequently, a drain-discharge current along the distance 'd' of the particle track 'A' may be 

15 created from the resultant collection of electrons. 

The holes generated along distance 'd' are repelled back to the P+ body tie 106, and 

then travel through the P+ body tie 106 connection to V S s. These traveling holes may also 

produce a current. Since the P+ body tie 106 may be ohmic or resistive, the current created 

by the holes traveling through the P+ body tie 106 may create a voltage rise from between 

20 the P+ body tie 106 to the V S s connection. 

If this voltage rise is large enough to forward bias the P-well 108 to N+ source 102 

junction under the gate oxide, a parasitic NPN-bipolar-junction transistor (not shown) coupling 

the N+ drain 104 to the N+ source 102 may switch to an ON state. The current resulting 
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from the traveling holes is then multiplied by the gain of the parasitic NPN-bipolar-junction 
transistor (BJT), and appears as a discharge current on the N+ drain 104. This discharge 
current only flows if the parasitic BJT is turned on. Thus, the discharge current may be 
approximately equal to the charge created by the particle intrusion multiplied by the gain of 
5 the parasitic BJT. 

As illustrated, a particle traveling along particle tracks 'B' and l C does not traverse 
the drain depletion region 110. However, the charges created by particles traveling along 
the B and C particle tracks diffuse to the nearest depletion region, which in this case is the 
drain-depletion region 110. As the diffusing holes and electrons reach the drain-depletion 

10 region 110, the electrons will be collected by the N+ drain 104 and the holes will be repelled 
back into the P-well 108, again creating the possibility of turning on the parasitic BJT. 

Figs. 2a and 2b are block diagrams illustrating a simplified layout and cross-section 
of an N-Channel MOSFET 200 experiencing a particle strike. The N-Channel MOSFET 200 
may be fabricated using a bulk material technology, such as bulk CMOS. The N-Channel 

15 MOSFET 200 shown in Figs. 2a and 2b is similar to the N-Channel MOSFET 100 shown in 
Figs, la and lb except that the N-Channel MOSFET 200 further includes an N-well 208 into 
which the P-well 108 is formed. 

When a particle travels along the particle track A, the portion of the track from which 
charge is collected is longer than in the N-Channel MOSFET 100 since the particle also 

20 crosses the P-well-to-N-well reversed-biased junction 208 under the N-channel MOSFET 200. 
Because the particle crosses the P-well-to-N-well reverse-biased junction 208, more electrons 
may be collected by the N+ drain 104, and more holes may be collected by the P-well 108, 
which increases the current in the P-well 108. 
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This may increase the voltage at the junction of the P-well 108 and N+ source 102 

under the gate oxide. The net result is that the charge that appears at the N+ drain 104 is 

the combination of the created charge that flows between the N+ drain 104 and P+ body tie 

106 plus the created charge times the gain of the parasitic BJT (if turned on) that flows 

5 between N+ drain 104 and N+ source 102. Both of these currents increase the probability 

of a SET, SEU, and/or SEE conditions. 

Figs. 3a and 3b are schematics of a CMOS inverter 302 and a CMOS two-input NAND 

gate 304, both of which are susceptible to SEE conditions. The inverter 302 may include a 

P-Channel transistor 302a coupled in series with an N-Channel transistor 302b. An output 

10 signal (designated as the "OUT" signal) is provided from an output terminal 302c located at a 
node at the intersection of the P-Channel transistor 302a and N-Channel transistor 302b. The 
gates of the P-Channel transistor 302a and the N-Channel transistor 302b are tied to an input 
signal (designated as "IN signal"). When the IN signal is a low state, then the P-Channel 
transistor 302a is in an ON state and the N-Channel transistor 302b is in an OFF state, which 

15 causes the OUT signal to be in a high state. 

If a particle strikes the N-Channel transistor 302b, then the created charge in N- 
Channel transistor 302b may result in a pull-down current that competes against the pull-up 
current of P-Channel transistor 302a, which may potentially disturb the high-state OUT signal. 
For example, when the pull-down current is sufficiently larger than the pull-up current, then the 

20 OUT signal may temporarily switch state, i.e., transition a low-state OUT signal. If the inverter 

302 is coupled to another logic gate and the OUT signal undesirably switches state, the 

effect of the errant OUT signal may be further propagated, thereby causing the other logic 

gate to experience a SET-induced state change. If the pull-down current is large enough to 

8 

McDonnell Boehnen Hulbert & Berghoff 
300 S. Wacker Drive. Root 3200 
Chicago, IL 60606 
312-9130001 



Express Mail No. EV 333553795 US 
Filed: January 15, 2004 

cause the OUT signal to fall to about a V S s level, the OUT signal may remain at about the V ss 
level until the P-Channel transistor 302a dissipates all of the created charge. 

A particle strike on P-Channel transistor 302a, on the other hand, will not disturb the 
high OUT voltage state because no voltage difference exists within P-Channel transistor 302a 
5 to cause charge movement towards the output terminal. Thus, none of the charge created 
by the particle strike is removed. 

If, immediately after the particle strike, the IN signal transitions to a high state, then 
the P-Channel transistor 302a may transition to an OFF state and the N-Channel transistor 
302b may transition to an ON state. The created charge within the P-type transistor 302a 

10 may be collected and not dissipated. As such, the collected charge may hinder or slow down 
the ability of the N-Channel transistor 302b to pull the OUT signal to a low state. The N- 
Channel transistor 302b may not be able to pull the OUT signal to the low state until it 
removes the created charge. In this case, the particle strike may not create an immediate 
state change, but it can delay a desired state change from occurring. 

15 In addition to causing undesirable state changes, the created hole-electron 

concentrations can be quite high, e.g., much higher than the surrounding structure of the 
semiconductor device, i.e., higher than the N or P-type impurity concentrations. This may 
result in a switching lifetime that is temporarily much shorter than normally present in the 
structure of the semiconductor device. Consequently, one of the SET condition generating 

20 mechanisms may result from a particle striking the semiconductor device when a finite 

voltage is applied across it. As one skilled in the art will recognize, when the IN signal is in a 

complementary state, then the charge collection mechanism switches from the P-Channel 

transistor 302a to the N-Channel transistor 302b. 
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Referring now to Fig. 3b, the NAND gate 304 may include a first P-Channel transistor 

304a coupled in series with first and second N-Channel transistors 304b, 304c. The gates 

of the first P-Channel transistor 304a and the first N-Channel transistor 304b are configured 

to receive a first of two input signals (designated as an "INI" signal) for which the NAND gate 

5 304 performs the NAND logical function on. The NAND gate 304 provides an output signal 

on its output terminal (designated as an "OUT" node) 304e at a node at the intersection of 

the first P-Channel transistor 304a and second N-Channel transistor 304c. The NAND gate 

304 also includes a second P-Channel transistor 304d having its drain coupled to the OUT 

node 304e. The gates of second N-Channel transistor 304c and the second P-Channel 

10 transistor 304d are configured to receive the second of two input signals (designated as an 

"IN2" signal). 

If, for example, the INI signal is in a high state and the IN2 signal is in a low state, 
then (i) the first P-Channel transistor 304a and the second N-Channel transistor 304c are in 
OFF states, and (ii) the second P-Channel transistor 304d and the first N-Channel transistor 

15 304b are in ON states, thereby causing the OUT signal to be in a high state. 

A particle strike on the second N-Channel transistors 304c may create two different 
pull-down-current paths. The first-pull-down current path may occur from between the drain of 
and body tie of the second N-Channel transistor 304c. The second-pull-down-current path 
may occur from between the drain and source of the second N-Channel transistor 304c, if a 

20 parasitic BJT (not shown) is turned on. The first N-Channel transistor 304b, however, may 
present a blocking impedance in series with a pull-down current that can occur between the 
drain and source of the second N-Channel transistor 304c hindering its ability to pull the OUT 
signal to a low state. 
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If, for example, the INI and IN2 signals are in low states, then (i) the first and second 

N-Channel transistors 304b, 304c are in an OFF state, and (ii) the first and second P-ChanneL 

transistors 304a, 304d are in and ON state, thereby causing the OUT signal to be in a high 

state. As above, a particle strike on the second N-Channel transistor 304c creates two pull- 

5 down currents; one from between the drain to the body tie of the second N-Channel transistor 

304c, and the second from between the drain to the source of the second N-Channel 

transistor 304c, if a parasitic BJT (not shown) is turned on. However, because the first N- 

Channel transistor 304b is in an OFF state, then the second pull-down current path may be 

cut off from V S s. 

10 Thus, the only second pull-down current component of the OUT signal is the 

displacement current that results from charging the capacitance on node nl. This 
capacitance may be much smaller than the capacitance on the output node 304e, thereby 
causing little effect on the OUT signal. Accordingly, the majority of the current of the OUT 
signal results from the first-pull-down current. 

15 The hole travel in the P-well of the second N-Channel transistor 304c, which can turn 

on its parasitic BJT, may also flow under the first N-Channel transistor 304b, and also turn on 
the parasitic BJT of the first N-Channel transistor 304b. Consequently, a pull-down current 
path from the output terminal through both the first and second N-Channel transistors 304c, 
304b to V S s is created. Consequently, the state of the OUT signal may not be in the desired 

20 state. 

As can be readily discerned from above, modern integrated circuits are susceptible 

to SEE conditions. Some solutions attempting to mitigate this susceptibility require the use 

of relatively complex combinational logic circuitry to provide logical or temporal isolation of 
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SEE that would otherwise cause errors. These solutions typically are not area efficient. 
Further, logic and temporal isolation circuit solutions can affect overall circuit speed and 
may, in some cases, be applicable only to storage circuits. Moreover, the susceptibility of to 
SEE conditions is heightened by reduced feature sizes and higher clock speeds that are 
5 otherwise very desirable. Thus, an area-efficient solution that provides a high degree of SET, 
SEE and/or SEE hardness and that is also applicable to various circuit types (such as 
combinational logic circuits as well as memory circuits) is needed. 
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SUMMARY 

A system and method for hardening a logic circuit against at least one of a single- 
event upset and single-event transient condition is provided. The system may include (and 
method may be carried out using) a logic circuit, first and second feed-forward devices, and 
5 first and second feedback devices. 

The logic circuit outputs independently-obtained first and second redundant signals. 
Each of the first and second feed-forward devices is operable to receive both of the first and 
second redundant signals. When the first and second redundant signals are in expected 
states, then (i) the first feed-forward device responsively provides a first feed-forward signal 
10 and (ii) the second feed-forward device responsively provides a second feed-forward signal. 

Each of the first and second feedback devices is operable to receive both of the first 
and second feed-forward signals. When the first and second feed-forward signals are in 
expected states, then (i) the first feedback device responsively feeds a first feedback signal 
back to the first redundant signal and (ii) the second feedback device responsively feeds a 
15 second feedback signal back to the second redundant signal, thereby completing first and 
second feedback loops. 

However, if one or both of the first and second redundant signals are in an 
unexpected state due to, for example, a radiation-particle intrusion, then one or both of the 
first and second feed-forward devices do not provide its respective feed-forward signal. 
20 Similarly, when one or both of the first and second feed-forward signals are in an unexpected 
state, then one or both of the first and second feedback devices does not feed back its 
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respective feed-back signal. Consequently, radiation-particle-intrusion effects are not further 
propagated. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

Preferred embodiments of the present invention are described with reference to the 
following drawings, wherein like reference numerals refer to like elements in the various 
figures, and wherein: 

5 Fig. la is a first block diagram illustrating a simplified layout of an N-Channel 

MOSFET; 

Fig. lb is a second block diagram illustrating a simplified cross-section of an N- 
Channel MOSFET; 

Fig. 2a is a third block diagram illustrating a simplified layout of another N-Channel 
10 MOSFET; 

Fig. 2b is a fourth block diagram illustrating a simplified cross-section of another N- 
Channel MOSFET; 

Figs. 3a and 3b are schematics of a prior art CMOS inverter and prior art two-input 
NAND gate; 

15 Fig. 4 is a fifth block diagram illustrating exemplary architecture of a cross-enabled, 

interlocked logic system; 

Fig. 5 is a sixth block diagram illustrating another exemplary architecture of a cross- 
enabled, interlocked logic system; 

Fig. 6 is a schematic diagram illustrating a three-input-tristate inverter; 
20 Fig. 7 is a schematic diagram illustrating a dual-input-tristate inverter; 

Fig. 8a is a simplified layout of a hardened N-Channel MOSFET that may be fabricated 

using a Silicon-On-lnsulator (SOI) fabrication technology; 
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Fig. 8b is a cross-section of the hardened N-Channel MOSFET that may be fabricated 

using the SOI fabrication technology; 

Fig. 9 is a transistor and gate-level circuit diagram illustrating an exemplary 

interlocked-logic register; and 

5 Fig. 10 is a component-level circuit diagram illustrating an architectural layout of an 

interlocked-logic register. 
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DETAILED DESCRIPTION 

Overview 

Fig. 4 is a block diagram illustrating exemplary architecture of a cross-enabled, 
interlocked logic system 400 for hardening a logic circuit against single-event upset (SEU) 
5 and/or single-event transient (SET) conditions in accordance with an exemplary embodiment. 
This cross-enabled, interlocked logic system 400 may be deployed with logic circuitry 402 
that provides independently-obtained redundant signals. The construction (e.g., transistor- 
level fabrication and configuration) of the logic circuitry 402 may provide a first level of 
hardening against SEU and/or SET conditions. 

10 The cross-enabled, interlocked logic system 400 may also be deployed with first and 

second feed-forward modules 404, 406 and first and second feedback modules 408, 110. 
By their construction and intercoupling (i.e., the manner in which the modules are coupled 
together), the first and second feed-forward modules 404, 406 and feedback modules 408, 
410 provide not only the first level, but also, a second level of hardening against SEU and/or 

15 SET conditions. 

In addition, a third level of hardening against SEU and/or SET conditions may be 
provided by certain layout configurations of the cross-enabled, interlocked logic system 400. 
As will be described in more detail below, the cross-enabled, interlocked logic system 400 
may be hardened against single, dual, and quadruple radiation particle intrusions using the 

20 combination of the three levels of hardening (i.e., construction, intercoupling and layout). 
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Exemplary Architecture 

The logic circuitry 402, the first and second feed-forward modules 404, 406 and the 
first and second feedback modules 408, 410 may be constructed using hardware, such as 
logic, processor and/or other circuitry; software executable by the hardware; and/or some 
5 combination thereof. The hardware circuitry may, for instance, be constructed using two or 
more serially coupled or "stacked" transistors (collectively referred to as a "transistor 
stack"). The construction and transistor-interconnection attributes of the transistor stack 
may be operable to prevent radiation or radiation particles from turning on or flipping the 
state of all the transistors in the transistor stack, thereby providing the first level of hardening 

10 against SEU and/or SET conditions. 

The hardware of the logic circuitry 402 may be configured so as to have a first input 
412 for receiving a desired input signal. Logically coupled with the first input 412 may be a 
plurality of control inputs, such as control inputs 414, 416 that are configured to receive a 
timing signal and a complement thereof. The timing signal and its complement may be used 

15 to control one or more output drivers of the logic circuitry 402. 

When, for example, the opposite states of the timing signal and the complementary 
signal thereof are present on the control inputs 414, 416, then logic circuitry 402 (via its 
logic function and output drivers) may output first and second redundant signals. The logic 
circuitry 402, however, may alternatively use two timing signals having the same state to 

20 control the output drivers. In either case, the first and second redundant signals may be 
supplied having the same or, conversely, the complementary state of the desired input 
signal. 
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Included among the output drivers are at least two independent output drivers 418, 
420. These independent output drivers 418, 420 may be configured to supply the first and 
second redundant signals. That is, the logic circuitry 402 may be deployed with circuitry that 
independently produces the first and second redundant signals, i.e., signals having the same 
5 or "expected" state. 

The first and second redundant signals may be fed to respective inputs 422, 426 of 
the first and second feed-forward modules 404, 406. In addition, the first and second 
redundant signals may be cross fed or "cross-coupled" to inputs 424, 428 of the second and 
first feed-forward modules 406, 404, respectively. By way of this cross-coupling or 
10 intercoupling, the first and second feed-forward modules 404, 406 give the cross-enabled, 
interlocked logic system 400 a second level of hardening against SEU and/or SET 
conditions, as described in more detail below. 

The first and second feed-forward modules 404, 406 may also be configured with a 
plurality of control inputs (not shown) for receiving a timing signal and complement thereof. 
15 This timing signal and the complement thereof may or may not be the same as the timing 
signal supplied to the logic circuitry 402. In an alternative embodiment, the first and second 
feed-forward modules 404, 406, however, might not be configured to receive the timing 
signal and complement thereof. 

The first and second feed-forward modules 404, 406 may also be configured with 

20 output drivers 430, 432 operable to produce respective first and second feed-forward 

signals in response to a logical operation on the respective and cross-coupled first and 

second redundant signals. If, for example, both of the first and second redundant signals are 

in an expected "high" state, and the first feed-forward module 404 is operable to perform a 
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comparison operation on its inputs 422, 428, then the output driver 430 of the first feed- 
forward module may produce a first feed-forward signal having a high state. 

The output driver 430 of the first feed-forward module 404 may, however, be 
configured to produce a first feed-forward signal having a complementary state of the first 
5 redundant signal if another (e.g., inverting) or alternative other logical operation is performed. 
Similarly, the second feed-forward module 406 (via its logical operators and output driver) 
may be configured to produce a second feed-forward signal having the same or 
complementary state of the second redundant signal. 

If, however, either of the first and second redundant signals is not in its expected 

10 state, then the cross-coupling prevents the first and second feed-forward modules 404, 406 
from further propagating these errant signals. To facilitate this, the first or second feed- 
forward modules 404, 406 do not change the state of their respective feed-forward signals 
whenever the first and second redundant signals are not the same. Alternatively, the first and 
second feed-forward modules 404, 406 may float the first and/or second feed-forward 

15 signals whenever the first and second redundant signals are not the same. That is, the 
output drivers 430, 432 of the first and second feed-forward modules 404, 406 may (i) leave 
the first and/or second feed-forward signals unchanged, and/or (ii) not further propagate 
unexpected states. 

The first and second feed-forward signals may be fed to other circuitry or devices 
20 along with being fed to inputs 434, 438 of the first and second feedback modules 408, 410, 
respectively. In accordance with the second level of hardening, the first and second feed- 
forward signals may be cross fed or "cross-coupled" to inputs 440, 436 of the second and 

first feedback modules 410, 408. That is, the first feed-forward signal may be fed to the 
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input 440 of the second feedback module 410, and the second feed-forward signal may be 
fed to the input 436 of the first feedback module 408. 

Each of the first and second feedback modules 408, 410 may also be configured 
with an output driver, such as output drivers 442, 444. These output drivers 442, 444 are 
5 operable to feed first and second feedback signals that result from a logical operation on the 
cross-coupled first and second feed-forward signals to the first and second redundant 
signals. When, for example, the first and second feed-forward signals are in expected states, 
then the first and second feedback modules 408, 410 may feed the expected state or 
complement of the expected state back to the respective first and second redundant signals. 

10 If, however, the first feed-forward signal is not in the expected state, then the output 

driver of the first feedback module 404 may float the first feedback signal. The output driver 
442 may, for example, leave the first feedback signal unchanged or, alternatively, not 
transfer the unexpected state back to the first redundant signal. Similarly, the output driver 
444 of the second feedback module 406 may float the second feedback signal when the 

15 second feed-forward signal is not in its expected state. 

Thus, if a radiation particle intrudes upon the circuitry of any of the logic circuitry 
402, the first and second feed-forward modules 404, 406, and/or the first and second 
feedback modules 408, 410, then the error caused by the intrusion is not further propagated 
through the cross-enabled, interlocked logic system 400. For example, if a radiation particle 

20 intrudes upon the logic circuitry 402 or other circuitry affecting the first redundant signal so 

as to cause the first redundant signal to be in an unexpected state, then the first feed-forward 

module 404 does not propagate the errant signal. This happens because the logical 

operation performed on the cross-fed second redundant signal and the first redundant signal 
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causes the output driver 430 of the first-feedforward module 404 to leave the first feed- 
forward signal unchanged. 

Similarly, if the second feed-forward signal enters an unexpected state as a result of 
a radiation particle intruding upon the second feed-forward module 406, then the output 
5 driver 444 of the second feedback module 410 does not propagate this errant signal to 
cause the second redundant signal to undesirably change state. This desirable operation 
occurs because the logical operation performed on the cross-fed first and second feed- 
forward signals cause the output driver 444 of the second feedback module 410 to leave the 
second redundant signal unchanged. 

10 The first and second feedback modules 408, 410 may leave the first and second 

redundant signals unchanged for so long as the radiation particle affects the second feed- 
forward signal. As one skilled in the art will recognize, the cross-coupling or intercoupling of 
the cross-enabled, interlocked logic system 400 provides the second level of hardening 
noted above. 

1 5 Exemplary Alternative Architecture 

Fig. 5 is a block diagram illustrating another exemplary architecture of a cross- 
enabled, interlocked logic system 500 for hardening a logic circuit against SEU and/or SET 
conditions. On a fundamental level, the cross-enabled, interlocked logic system 200 relies 
on circuitry redundancies, detection of differing intermediary signals, and intercoupling to 

20 provide an output signal that is unaffected by multiple strikes of radiation particles. 

Taking advantage of the ability to float its output signal when its inputs differ, the 

cross-enabled, interlocked logic system 500 may be deployed with logic circuitry 202 that 

may be constructed from first and second tristate inverters 501, 503. The tristate inverters 
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501, 503 may provide independent first and second redundant signals, each of which can be 
in any of three states (i.e., high, low or floating). 

Referring to Fig. 6, a schematic diagram illustrating a three-input-tristate inverter 600 
that may be used to form the first and/or second tristate inverters 501, 503 is shown. The 
5 three-input-tristate inverter 600 may include first and second P-Channel transistors 602, 604 
and first and second N-Channel transistors 606, 608. The first N-Channel transistor 606 
may be connected in series with the second N-Channel transistors 608. The two N type 
transistors may be connected between a ground supply node (V ss ) and an output (OUT) node 
612. 

10 The first P-Channel transistor 602 may be connected in series with the second P- 

Channel transistor 604. The first and second P-Channel transistors 602, 604 may be 
connected between a power supply node (V D d) and the OUT node 612. The gate terminals of 
the first N-Channel and the first P-Channel transistors 606, 602 are connected to form a first 
input (IN) node 614. The gate terminal of second N-Channel transistor 608 forms a second 

15 input (EN) node 616, and the gate terminal of the second P-Channel transistors 604 forms a 
third input (ENN) node 618. 

The operation of the three-input-tristate inverter 600 is such that when the EN signal 
on the EN node 616 is at a high state (e.g., a logic 1) and an ENN signal at the ENN 618 
node is at a low state (e.g., a logic 0), then the logic state on an OUT signal on the OUT node 

20 612 will be the complement of the logic state on an IN signal received on the IN node 614. 

For example if (i) the IN signal is at a logic 0, (ii) the EN signal is at a logic 1, and (ii) ENN is at 

a logic 0, then the OUT signal is at a logic 1. Alternatively, if (i) the EN signal is at a logic 0 

and (ii) ENN signal is at logic 1, then the OUT node 712 signal will float (commonly referred 
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to as "tristated"). This happens because the logic value on the OUT terminal is not actively 
driven by either the series combination of first and second N-Channel transistors 606, 608 or 
the series combination of first and second P-Channel transistors 602, 604. Rather, the OUT 
node 612 is held at the previous logic state of OUT signal due to a charge storage on the 
5 capacitance inherent on any logic signal. Typically, the EN and ENN signals are assumed to 
be the complement of one another. 

Referring back to Fig. 5, the cross-enabled, interlocked logic system 500 may also 
include two additional intercoupled stages to further harden the system 500 against multiple 
particle strikes. The first additional stage may be deployed using cross-coupled first and 

10 second feed-forward modules 504, 506. The first and second feed-forward modules 504, 
506 may also be beneficially constructed from tristate inverters 505, 507, respectively. The 
second additional stage may be deployed using cross-coupled first and second feedback 
modules 508, 510. The first and second feedback modules 508, 510 may likewise be 
constructed using tristate inverters 509, 511, respectively. 

15 Referring back to Fig. 7, a schematic diagram illustrating a dual-input-tristate inverter 

700 that may be used to form any of the tristate inverters 505, 507, 509, and 511 is shown. 
The dual-input-tristate inverter 700 may include first and second P-Channel transistors 702, 
704 and first and second N-Channel transistors 706, 708. The first N-Channel transistor 
706 may be connected in series with the second N-Channel transistors 708. The first and 

20 second N-channel transistors 706, 708 may be connected between a ground supply node 

(V ss ) and an output (OUT) node 712. The first P-Channel transistor 702 may be connected in 

series with the second P-Channel transistors 704. The first and second P-Channel transistors 

702, 704 may be connected between a power supply node (V d d) and the OUT node 712. 
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The gate terminals of first N-Channel transistor 706 and the first P-Channel transistor 

702 are connected to form a first input (INI) node 714. Similarly, the gate terminals of 

second N-Channel transistor 708 and the second P-Channel transistor 704 are connected to 

form a second input (IN2) node 716. 

5 The operation of the dual-input-tristate inverter 700 is as follows. When both the INI 

and IN2 nodes 714, 716 are in at same logic state, then the dual-input-tristate inverter 700 

will drive the complement of that state onto the OUT node 712. For example, if INI and IN2 

signals are at a logic 1 state, then both first and second N-Channel transistors 706, 708 will 

be in an ON state so as to provide a conduction path between the OUT node 712 and V ss . 

10 This may cause the OUT signal driven onto the OUT node 712 to be a logic 0. 

If, on the other hand, the INI and IN2 signals have opposite logic states, then no 
conduction path will be formed between OUT node 712, and either the V ss or V D d supply 
nodes. In this case the OUT signal is tristated because the logic value on OUT node is not 
actively driven. Consequently, the logic value on OUT node 712 may maintain its previous 

15 state due to charge storage, as noted above. In this way, the dual-input-tristate inverter 700 
may act as a comparator or voter circuit. That is, if both inputs are at the same state then 
the OUT node 712 is driven accordingly, if they are not at the same state then the OUT node 
is held at its previous state until both inputs are the same. 
Fabrication Technologies 

20 Each of the tristate inverters 501, 503, 505, 507, 509, and 511 may be fabricated 

using any of the various fabrication techniques noted above, including Bulk CMOS, SOI, 

BiCMOS, etc. In bulk technology fabrication, such as bulk CMOS, each MOSFET of the 

tristate inverters 501, 503, 505, 507, 509, and 511 can have their body ties connected to 
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Vdd, and/or V S s. Due to the common substrate or body ties in bulk technologies, however, 
parasitic diodes may be created between devices. Such parasitic diodes are probably not an 
optimal solution against SEU and/or SET conditions. Instead of using a bulk technology, a 
Silicon-On-lnsulator (SOI) or other similar device-insulating fabrication technology may provide 
5 a more optimal solution for hardening devices against SET and/or SEU conditions. 

Fig. 8a is a simplified layout of a hardened N-Channel MOSFET 800 and Fig. 8b is a 
cross-section of the hardened N-Channel MOSFET 800; both of which may be fabricated 
using the SOI fabrication technology. When fabricated as such, the substrate well region of 
N-Channel MOSFET 800 may be isolated (using, for example, oxide-material to separate the 

10 N-Channel MOSFET 800) from substrate well regions of other MOSFETs formed in the same 
circuit. As a result, the N-Channel MOSFET 800 may be fabricated without parasitic diodes 
formed between and among the N-Channel MOSFET 800, other MOSFETs, V DD , and V S s. 

While particle tracks "A," "B," and "C" are shown normal to the surface of the N- 
Channel MOSFET 800, particles can strike in any direction and travel along one of a multitude 

15 of different straight-line or solid-angle particle tracks. Thus, a particle may possibly travel 
horizontally through silicon of a stacked transistor module. When this happens to an N- 
channel transistor stack, such as in the hardened inverter circuit 600, a particle may track 
through the sensitive volumes of both MOSFETs, but the particle's effect may be orders of 
magnitude less than through any one MOSFET. By structuring and/or laying-out the hardened 

20 inverter circuit 600 or other hardened device, the number of possible particle tracks through 
which a particle must pass to cause SET and/or SEU conditions may be reduced. 
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Intercoupling Hard ning 

Referring back to Fig. 5, both of the first and second feed-forward tristate inverters 
505, 507 may be configured to receive these first and second redundant signals so as to 
exploit circuit redundancies and the ability to tristate. In an exemplary embodiment, the first 
5 redundant signal is (i) fed to the gate terminals of the first N-Channel and first P-Channel 
transistors of the first feed-forward-tristate inverter 505, and (ii) cross fed to the gate 
terminals of the second N-Channel and second P-Channel transistors of the second feed- 
forward-tristate inverter 507. Similarly, the second redundant signal may be (i) fed to the 
gate terminals of the first N-Channel and first P-Channel transistors of the second feed- 

10 forward-tristate inverter 507, and (ii) cross fed to the gate terminals of the second N-Channel 
and second P-Channel transistors of the second feed-forward-tristate inverter 505. 

Under desired operation, when the first and second redundant signals are in the same 
state, the output terminals of both of the first and second feed-forward-tristate inverters 505, 
507 supply first and second feed-forward output signals that are complementary to the state 

15 of the first and second redundant signals. The logic circuit 502, however, may be configured 
to provide the first and second redundant signals in complementary states. As such, an 
inverter (not shown) may be added between one of the first and second feed-forward-tristate 
inverters 505, 507 to invert one of the first and second redundant signals. 

In the former case, when the first and second redundant signals are in a low (or high) 

20 state, the output terminals of the first and second feed-forward-tristate inverters 505, 507 

supply the first and second feed-forward output signals in a high (or low) state. On the other 

hand, if, for example, the desired state of the first and second redundant signals is a low 

state, but the second redundant signal is unexpectedly in a high state, then (i) the first feed- 
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forward-tristate inverter 505 tristates its output signal so as to not change the state of the 
first feed-forward signal and (ii) the second feed-forward-tristate inverter 507 likewise tristates 
its output signal so as to not change its state. The converse is true when the first redundant 
signal is unexpectedly in a high state instead of the second redundant signal. Other 
5 combinations are possible as well. 

In addition to being available for coupling to another stage of circuitry, the output 
terminals of the first and second feed-forward-tristate gates 505, 507 supply the first and 
second feed-forward signals to the gate terminals of the first N-Channel and first P-Channel 
transistors of the first and second feedback-tristate gates 509, 511, respectively. Making 

10 use of the circuit redundancies and the ability to tristate, the first and second feed-forward 
signals are also cross-fed to the gate terminals of the second N-Channel and second P- 
Channel transistors of the second and first feedback tristate inverters 511, 509. 

When, under intended operation, the first and second feed-forward output signals are 
in the same state, the output terminals of the first and second feedback-tristate inverters 

15 509, 511 feed the first and second feedback output signals back into gate terminals of the 
first N-Channel and first P-Channel transistors of the first and second feed-forward-tristate 
inverters 505, 507. Given that the first and second feedback-tristate inverters 509, 511 are 
inverters, the first and second feedback output signals may be supplied as complements of 
the first and second feed-forward output signals. Under desired operation, these first and 

20 second feedback output signals are in the same state as the first and second redundant 

signals, thereby closing the feedback loop. 

If, however, the desired state of the first and second feed-forward signals is a low 

state, but the first feed-forward signal is unexpectedly in a high state, then (i) the second 
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feedback-tristate inverter 511 tristates its output signal so as to not change its state and (ii) 
the first feedback-tristate inverter 509 also tristates its output signal so as to not change its 
state. The converse is true when the second feed-forward signal is unexpectedly in a high 
state instead of the first redundant signal. Other combinations are possible as well. 
5 In light of the foregoing, the fabrication and intercoupling hardening may make the 

cross-enabled, interlocked logic system 500 immune to not only a single or dual, but a 
quadruple particle intrusion. Such protection is realizable, given that (i) two or more particle 
intrusions may be necessary to upset the stacked transistor tristate inverters and (ii) two or 
more of the inverters 501, 503, 505, 507, 509, and 511 may need to be upset before the 

10 cross-enabled, interlocked logic system 500 can be upset. While quadruple particle 
intrusions are highly unlikely or almost impossible (since it is believed that particles travel in 
straight lines), the third level of system hardening against SEU and/or SET conditions may be 
provided to bolster such protection. This protection may be provided using various transistor 
layout configurations for the cross-enabled, interlocked logic system 500. 

15 System Layout Hardening 

Fig. 9 is a transistor and gate-level circuit diagram illustrating an embodiment of an 
interlocked-logic register 900. The interlocked logic-register 900 may be formed by 
cascading a first cross-enabled, interlocked logic system, such as the cross-enabled, 
interlocked logic system 500, with a second of such systems. 

20 Thus, each of the first and second cross-enabled, interlocked logic systems may be 

constructed from logic circuitry 502(a-b) and first and second latches 902(a-b), 904(a-b). 
Each of the first latches 902(a-b) may be constructed from the combination of the first feed- 
forward and first feedback inverters 505, 509. Each of the second latches 904(a-b) may be 
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constructed from the combination of the second feed-forward and second feedback inverters 
507, 511. Instead of receiving a single desired input signal at the logic circuitry 502(b), dual 
input signals are received. The first of the dual input signals is received from the first latch 
902(a) and the second of the dual input signals is received from the second latch 904(a). 
5 Outputs of the first and second latches 902(b), 904(b) may be fed to first and second 

inverting-driver outputs 906, 908. Like the rest of the circuitry of the interlocked logic- 
register 900 the first and second inverting-driver outputs 908, 908 may be constructed using 
stacked transistors, such as the tristate inverter 700 (Fig. 7). The first and second inverting- 
driver outputs 908, 908 may take other forms as well. 
10 As noted above, the output of each of logic circuitry 502(a-b) may be controlled by a 

timing signal and complement thereof. To increase the interlocked logic-register 900 
immunity to quadruple particle intrusions, the timing signal and its complement may be 
separated into dual timing signals and complements thereof. This may be facilitated by 
clocking circuitry 910. 

15 The clocking circuitry 910 may be formed using first and second clocking inverters 

912, 914. The first and second clocking inverters 912, 914 may separate and invert an 
incoming clocking signal so as to supply redundant first and second complementary timing 
signals, respectively. The first and second redundant complementary timing signals may 
then be fed to third and fourth clocking inverters 916, 918. The third and fourth clocking 

20 inverters 916, 918 may in turn supply first and second redundant timing signals. 

Each of first, second, third and fourth clocking inverters 912-918 may be formed as 
tristate inverters using, for example, any of the various fabrication techniques noted above. 
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In such construction, each of the first, second, third and fourth clocking inverters 912-918 
may provide immunity against dual particle intrusions, and SET and/or SET conditions. 

Quadruple-particle-intrusion immunity for the timing signal controlled circuitry, 
however, may be realizable without intercoupling hardening. If, for example, the logic circuit 
5 502(a) is formed from first and second P-Channel transistors 920, 922 coupled in series with 
first and second N-Channel transistors 924, 926 as noted above, then the transistor 
fabrication of these transistors 920-926 may allow for hardness against dual particle 
intrusions. 

By physically locating the transistors of the first and second tristate inverters 920- 
10 926 and 928-934 in such a way as to prevent a single particle track from passing through all 
four N type transistors 924, 926, 932, and 934 or all four P type transistors 920, 922, 928, 
and 930, both redundant signals can be prevented from experiencing a simultaneous 
radiation induced transient upset. Similarly, by locating clocking inverters 912 and 916 apart 
from inverters 914 and 918 a single particle track can be prevented from upsetting both 
15 clock signals simultaneously. On the other hand, fabrication and intercoupling hardening 
allow the tristate inverters of the first and second latches 902(a-b), 904(a-b) to be co-located, 
thereby saving precious circuit area. 

Fig. 10 is a component-level circuit diagram illustrating an architectural layout of 
interlocked-logic register 900. The interlocked logic-register 900 illustrated in Fig. 10 is 
20 formed in a "rail-stack" configuration. In this rail-stack configuration, three rails are deployed. 
The first and third rails provide separate running connections to V D d. The second rail is a 
common rail providing a running connection to V S s. One skilled in the art will recognize that 
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depending on the type of transistors used, the first and third rails may provide a running 
connection to V S s, and the second rail may provide a running connection to V D d- 

As shown by callouts 1002, 1004, the tristate inverters of the first and second feed- 
forward inverters 505, 507 may be co-located since no particle intrusion can strike all their 
5 transistors. Callouts 1006, 1008, however, illustrate strategic placement of the clocking 
inverters 912 and 916 apart from inverters 914 and 918. 

CONCLUSION 

In view of the wide variety of embodiments to which the principles of the present 
invention can be applied, it should be understood that the illustrated embodiments are 

10 exemplary only, and should not be taken as limiting the scope of the present invention. For 
example, the steps of the operational modes may be taken in sequences other than those 
described, and more or fewer elements may be used in the block diagrams. In addition, use 
of the term "means" in any claim is intended to invoke 35 U.S.C. §112, paragraph 6, and any 
claim without the word "means" is not so intended. Therefore, all embodiments that come 

15 within the scope and spirit of the following claims and equivalents thereto are claimed as the 
invention. 

It will be understood, however, that changes and modifications may be made to the 
invention without deviating from its true spirit and scope, as defined by the following claims. 
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